Anthony J. Bentley <[email protected]> wrote: > Michael Richardson writes: >> And given EFAIL, it seems that we were wise.
> nmh wise? I dunno. Part of EFAIL was that the mail client downloaded
> bits from the Internet and interleaved them seamlessly into the
> message.
No, that downloading from the Internet was entirely a normal thing.
It's that the MUAs failed to run the HTML bits in seperate sandboxes.
(Or that they ran the HTML bits at all)
> That seems like an inherently dangerous thing to do... and nmh does it
> with one of the messages in this very thread: Ralph Corderoy's message
> contains a 'Content-Type: message/external-body; access-type="url";
> url="..."' bit that was promptly fetched and displayed in the middle of
> the message. How do I disable this behavior, and why does nmh have it
> turned ON by default!?
I don't remember how to turn it off; I don't think it is on by default.
Did you build from source, or from a package?
--
] Never tell me the odds! | ipv6 mesh networks [
] Michael Richardson, Sandelman Software Works | network architect [
] [email protected] http://www.sandelman.ca/ | ruby on rails [
signature.asc
Description: PGP signature
-- nmh-workers https://lists.nongnu.org/mailman/listinfo/nmh-workers
